Vulnerability DatabaseCVE-2026-56130
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-56130
Published:June 25, 2026
Updated:August 04, 2026
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.
Affected Packages
https://github.com/apache/shiro.git (GITHUB):
Affected version(s) >=shiro-root-1.2.4 <shiro-root-3.0.0
Fix Suggestion:
Update to version shiro-root-3.0.0
Related Resources (2)
https://lists.apache.org/thread/9k9b3bmlq516ylvf7cdp3dlrtdtmxbmo
http://www.openwall.com/lists/oss-security/2026/06/24/8
Do you need more information?
Contact Us
CVSS v4
Base Score:
2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
ACTIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Authentication Bypass by Capture-replay
CWE-294
EPSS
Base Score:
0.22